Uncommon Extension In Keyboard Layout IME File Registry Value

 1title: Uncommon Extension In Keyboard Layout IME File Registry Value
 2id: b888e3f2-224d-4435-b00b-9dd66e9ea1f1
 3related:
 4    - id: 9d8f9bb8-01af-4e15-a3a2-349071530530
 5      type: derived
 6status: experimental
 7description: |
 8    Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
 9    Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
10    IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.    
11references:
12    - https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/
13author: X__Junior (Nextron Systems)
14date: 2023/11/21
15tags:
16    - attack.defense_evasion
17    - attack.t1562.001
18logsource:
19    product: windows
20    category: registry_set
21detection:
22    selection:
23        TargetObject|contains|all:
24            - '\Control\Keyboard Layouts\'
25            - 'Ime File'
26    filter_main_known_extension:
27        Details|endswith: '.ime'
28    condition: selection and not 1 of filter_main_*
29falsepositives:
30    - IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
31level: high